Add workflow for complaints to the ICO

[hsenag]

We should allow our users to complain to the ICO via the site.

Technically, it might just be as simple as sending a pre-formed email to casework@ico.gsi.gov.uk, but we need to think about appropriate text on how to guide users through the process and perhaps talk to the ICO before enabling it.

[RichardTaylor]

Suggested template letter:

Subject: Application for Decision by Information Commissioner

Dear Information Commissioner,
I would like to make an application for a decision by the Information Commissioner, as provided for by Section 50 of the Freedom of Information Act 2000, in respect of the request for information made via:

[WhatDoTheyKnow Request URL]

All relevant correspondence related to the request is available via that link and I can confirm that I made the request in question.

[Prompt for user to explain why they are not happy with their internal review response]

[Signature as on other correspondence]

A different template could be offered when a user wants to write to the ICO in respect of a lack of response - in such cases there would be no internal review.

[RichardTaylor]

Based on experience from the WhatDoTheyKnow team it looks like an explicit request for a reply by email would be required; and the ICO could be expected to provide an email response.

[garethrees]

A different template could be offered when a user wants to write to the ICO in respect of a lack of response - in such cases there would be no internal review.

It more-or-less looks like you need to ask for an internal review in to the request before complaining to the ICO.

[RichardTaylor]

The advice published at:

https://www.whatdotheyknow.com/help/unhappy

If ... You didn't get a reply within 20 working days... you can
Complain directly to the Information Commissioner.

and

Although the Information Commissioner has worked hard to reduce their backlog of casework, it can still take several months to get resolution from them in most circumstances. One area where they have sped up things considerably is that they are able to prompt non-responsive authorities to reply within a few weeks of receiving a complaint.

is based on correspondence with the ICO.

I suggest making the refer to the ICO option available in cases where:

• there has been no-response (other than an acknowledgement) for 20 working days after the request was made. ie when request is still in the waiting_response state after 20 working days
• 20 working days have elapsed since making an internal review request
• an internal review appears to have been completed
• an administrator has enabled referrals to the ICO for a request (we can use this to deal with edge cases)

I think a key aim ought be to prevent inappropriate referrals to the ICO too soon - that should help us defend the feature as responsible and proportionate.

As for the linked ICO advice to people who've not had a response after 20 days suggesting they restate their request - I think that risks being considered a new request - I'd advise chasing a response and being prepared to quite rapidly then refer to the ICO if no response was forthcoming.

I'd be happy to see simpler criteria for offering the refer to the ICO option - so long as we can point to efforts to prevent referrals being made too soon.

[FOIMonkey]

The proposed template looks good. I agree that requesters should be given the opportunity to complain when 20 working days have passed with no response - the ICO is usually happy to deal with these. I think that we can also expect some push back about this from them based on how they handle complaints made via WDTK at the moment: https://www.whatdotheyknow.com/request/complaint_about_handling_of_requ#incoming-702656
There is no legal basis for refusing to deal with these however.

[RichardTaylor]

Important suggestions at:

https://github.com/mysociety/alaveteli/wiki/Complaining-to-ombudsman---feature-requirements

• Make referrals to the Scottish Information Commissioner when appropriate.
• Don't allow referrals in respect of requests to bodies marked foi_no (not subject to FOI).

I think the template proposed above is fine for EIR_only bodies too as the provision for enforcement there is also Section 50 of the Freedom of Information Act 2000 (See paragraph 18 of the Environmental Information Regulations)

[Avizandum]

A few of points on this feature:

1. no application can be made to the SIC without there first having been a request for internal review (even where there has been no response to the request)

2. SIC is required under the terms of FOISA to send a DN by post

3. There are certain situations where FOISA prevents an application to the Commissioner; however, I don't think we need to take much account of that in any extension. It's up to the SIC whether an application can be investigated or not, and they are so limited that it's probably not worth the time and effort in programming.

4. I noticed in the annual report published by OSIC that they are developing on online application feature. It might therefore be worthwhile making contact with them to see if we can in someway feed into that.

Alistair

[garethrees]

We also need to disable complaints to the ICO after N months:

SIC

Is it less than 6 months since you received the response to your review request?

http://www.itspublicknowledge.info/YourRights/Unhappywiththeresponse/AppealingtoCommissioner.aspx

ICO

We will not usually investigate concerns where there has been an undue delay in bringing it to our attention. You should raise your concerns with us within three months of your last meaningful contact with the organisation concerned.

https://ico.org.uk/concerns/getting/

[garethrees]

4. I noticed in the annual report published by OSIC that they are developing on online application feature. It might therefore be worthwhile making contact with them to see if we can in someway feed into that.

+1

[garethrees]

Louise, Liz and I met up last Friday and had a chat about this.

Could you check our understanding of what the ICO can do about a complaint?

We think they can send a "Decision Notice" which broadly answers:

• Is the authority in breach?
• Are there any steps to be taken?

In terms of actual results they could:

• Never respond
• Respond and say the public body should give the information
• Respond and say the public body's decision is correct

---

We were also wondering what your thinking was on a new status:

1. Sending the email should trigger a change of status to a new status called "the regulator has been informed that this request is overdue"

Could you elaborate on why you ask for this? We think we have a good idea, but just want to hear what your thinking was.

[FOIMonkey]

There is a fourth option for the ICO response which is "respond and say that an authority should respond to the request". This is usually given where an authority has not replied to a request at all, but is also issued when a body is found to be subject to EIR. It does not always mean that any info will end up being provided as exemptions may still apply etc.

[schlos]

We did this by re-using a contact form and creating templates with prefilled FOI Motion messages. This presentation shared to MySoc explains what we did:
https://docs.google.com/presentation/d/11QqXOu5txa2y9s2dfyyGzFkwUn8yZ3jGuYT-ybH3GSs/edit

Basically, when user lands on the /help/unhappy/request_slug URL, we will show forms if for that specific request status we have some forms to show (those forms are prefilled automatically), otherwise, users will see link to the generic FOI Motion page where logged users will see all available forms that are prefilled with last viewed body or request (if available). In all cases, user can change subject and body before sending.

Email gets sent to our ticketing system which:

• forwards a FOI Motion email to the Information Commissioner
• sends email confirming that FOI Motion is sent to the Information Commissioner (with content of a FOI Motion email sent to the Information Commissioner)

Changes are done in imamopravoznati-theme branch: imamopravoznati-0.39.0.0
https://github.com/codeforcroatia/imamopravoznati-theme/tree/imamopravoznati-0.39.0.0

They are Live on IPZ and in use for some time now.

---

Regarding FOI Motion

• Croatian FOIA allows reporting any irregularities to the Information Commissioner inspector using FOI Motion
• FOI Motion does not impose the same obligations to the reporter as normal Appeal - FOI Motion can be sent unsigned and without need to provide a postal address and no OIB (national ID number) needed
• Appeal cannot be used to send from our website because it requires sender (FOI requester) to give a full address, National ID number, and form has to be signed
• FOI Motion is a basis for the inspector to conduct a formal inspection of a FOIA processed done by teh public authority whereas Appeal is for a specific request for a particular reason and in my experience Appeal process usually takes a lot longer than FOI Motion. If request is unanswered after due date, FOI motion will result in much quicker response (i.e. after few weeks, although after due date). Appeal in the case scenario can take more moths up to a year.

[schlos]

We translated the FOI Motion page so you get a better understanding of a content and scope, you can check it here:
https://imamopravoznati.org/en/help/foi_motion
(login to see all examples)